org.bouncycastle:bctls-fips@1.0.11.2 vulnerabilities
-
latest version
1.0.19
-
latest non vulnerable version
-
first published
5 years ago
-
latest version published
2 months ago
-
licenses detected
- [1.0.0,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.bouncycastle:bctls-fips package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.| Vulnerability | Vulnerable Version |
|---|---|
Affected versions of this package are vulnerable to Observable Discrepancy due to the timing difference between exceptions thrown when processing RSA key exchange handshakes, AKA Marvin. Note: The implemented fix mitigates the leakage of data via the PKCS#1 interface, but does not fully alleviate the side-channel as it allows cases in which the padding check fails but the handshake succeeds. How to fix Observable Discrepancy? Upgrade |
[,1.0.19)
|